Re:Reversing the Petya ransomware with constraint solvers
by musesum on Saturday April 23, 2016 @03:06PM
(#11556949)
Aha, looks like SteadyState accomplishes the same thing. Very cool! I wonder how a Windows Restore Point is defeated? Because it is in the same partition?
[ Parent
| on HN ]
Re:Reversing the Petya ransomware with constraint solvers
by rzzzt on Saturday April 23, 2016 @03:44PM
(#11557103)
Malware can disable System Restore and delete existing restore points if the user account they are running under has the rights to do so. I think the Cryptolocker variants did this, but not sure...